chore: add benchmark to measure cost of use #292
Conversation
![datadog-datadog-prod-us1[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
| } | ||
|
|
||
| func (h *harness) exec(name string, args ...string) { | ||
| cmd := exec.Command(name, args...) |
There was a problem hiding this comment.
🟠 Code Vulnerability
Check command call and ensure there is no unsanitized data used. The variable `name` may need to be validated (...read more)
In Go, the exec.Command function is used to run external commands. Using this function carelessly can lead to command injection vulnerabilities.
Command injection occurs when untrusted input is passed directly to a system shell, allowing an attacker to execute arbitrary commands. This can result in unauthorized access to the system, data leaks, or other security breaches.
To prevent command injection vulnerabilities when using exec.Command in Go, follow these coding best practices:
- Sanitize User Input: Always validate and sanitize user inputs before passing them to
exec.Command. Avoid executing commands constructed using user-provided data. - Avoid using Shell Expansion: If possible, pass the command and arguments as separate strings to
exec.Command. This prevents the shell from interpreting special characters in a potentially malicious way. - Use Absolute Paths: When specifying the command to be executed, use absolute paths for executables whenever possible. This reduces the risk of inadvertently running a similarly named malicious command from the system's PATH.
- Avoid String Concatenation: Refrain from dynamically constructing commands by concatenating strings. Instead, use the
arg ...stringparameter ofexec.Commandto pass arguments safely. - Limit Privileges: Run commands with the least privilege required to carry out the task. Avoid running commands with elevated privileges unnecessarily.
By following these practices, you can reduce the risk of command injection vulnerabilities when using exec.Command in Go and enhance the security of your application.
| orchestrionBinOnce.Do(func() { | ||
| orchestrionBin = filepath.Join(rootDir, "bin", "orchestrion.exe") | ||
|
|
||
| cmd := exec.Command("go", "build", fmt.Sprintf("-o=%s", orchestrionBin), rootDir) |
There was a problem hiding this comment.
🟠 Code Vulnerability
Check command call and ensure there is no unsanitized data used. The variable `rootDir` may need to be validated (...read more)
In Go, the exec.Command function is used to run external commands. Using this function carelessly can lead to command injection vulnerabilities.
Command injection occurs when untrusted input is passed directly to a system shell, allowing an attacker to execute arbitrary commands. This can result in unauthorized access to the system, data leaks, or other security breaches.
To prevent command injection vulnerabilities when using exec.Command in Go, follow these coding best practices:
- Sanitize User Input: Always validate and sanitize user inputs before passing them to
exec.Command. Avoid executing commands constructed using user-provided data. - Avoid using Shell Expansion: If possible, pass the command and arguments as separate strings to
exec.Command. This prevents the shell from interpreting special characters in a potentially malicious way. - Use Absolute Paths: When specifying the command to be executed, use absolute paths for executables whenever possible. This reduces the risk of inadvertently running a similarly named malicious command from the system's PATH.
- Avoid String Concatenation: Refrain from dynamically constructing commands by concatenating strings. Instead, use the
arg ...stringparameter ofexec.Commandto pass arguments safely. - Limit Privileges: Run commands with the least privilege required to carry out the task. Avoid running commands with elevated privileges unnecessarily.
By following these practices, you can reduce the risk of command injection vulnerabilities when using exec.Command in Go and enhance the security of your application.
Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #292 +/- ##
==========================================
- Coverage 73.80% 73.77% -0.03%
==========================================
Files 145 145
Lines 7966 7958 -8
==========================================
- Hits 5879 5871 -8
Misses 1658 1658
Partials 429 429
|
Checking by comparing
traefik/traefik(and some other projects) andDataDog/orchestrionwith and withoutorchestrion, and posting results to the job summary (for now).